Direct Syscall via Assembly Bytes

[rule]
description = """
Identifies attempts to call a System call directly using assembly instructions and from unusual native system module
ntdll. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.
"""
id = "e0abc200-a578-4e3a-bd1a-eded0c32a245"
license = "Elastic License v2"
name = "Direct Syscall via Assembly Bytes"
os_list = ["windows"]
version = "1.0.24"

query = '''
any where process.executable != null and
(
(event.category in ("registry", "file") and
 process.thread.Ext.call_stack_summary like "?*" and not process.thread.Ext.call_stack_summary like "ntdll.dll*" and
 not process.thread.Ext.call_stack_summary in ("Unknown", "Unknown|Unbacked") and 
 /* mov r10,rcx, mov eax,ssn, syscall */
 _arraysearch(process.thread.Ext.call_stack, $entry,
               $entry.callsite_leading_bytes like ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05"))) or

 (event.category == "process" and
  process.parent.thread.Ext.call_stack_summary like "?*" and not process.parent.thread.Ext.call_stack_summary like "ntdll.dll*" and
  /* mov r10,rcx, mov eax,ssn, syscall */
  _arraysearch(process.parent.thread.Ext.call_stack, $entry,
               $entry.callsite_leading_bytes : ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05")))
) and
not process.executable :
            ("?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
             "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Program Files (x86)\\Chromium\\Application\\chrome.exe",
             "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
             "?:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
             "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\acrocef_*\\AcroCEF.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\acrocef_*\\AcroCEF.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe",
             "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
             "?:\\Program Files\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
             "?:\\Program Files\\BackupClient\\TrayMonitor\\MmsMonitor.exe",
             "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe",
             "?:\\Program Files\\Google\\Update\\GoogleUpdate.exe",
             "?:\\Program Files\\BackupClient\\TrayMonitor\\MmsMonitor.exe",
             "?:\\Program Files (x86)\\BackupClient\\TrayMonitor\\MmsMonitor.exe", 
             "?:\\Program Files\\Mozilla Firefox\\updated\\firefox.exe", 
             "?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe", 
             "?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe", 
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\*\\Teams.exe", 
             "?:\\Program Files\\Veeam\\Endpoint Backup\\Veeam.EndPoint.Manager.exe",
             "?:\\Program Files\\Netmarble\\Netmarble Game\\*",
             "?:\\Program Files (x86)\\SolarWinds\\Agent\\Plugins\\ADMProbe\\SolarWinds.ADM.AgentPlugin.exe",
             "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
             "?:\\Program Files\\New Relic\\newrelic-infra\\newrelic-integrations\\nr-winpkg.exe") and
 not (process.code_signature.subject_name in~ 
               ("Google LLC", "Mozilla Corporation", "Rockstar Games, Inc.", "Commvault Systems, Inc.", "Galooli Ltd", "TOTVS S.A", "ROBLOX CORPORATION",
                "Roblox Corporation", "SIGNODE PACKAGING GROUP NZ", "GraphOn Corporation", "Blizzard Entertainment, Inc.", "343 Industries (Microsoft Corporation)") and
      process.code_signature.trusted == true) and
 not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and
 not (process.executable : "?:\\Windows\\System32\\auditpol.exe" and process.parent.executable : "?:\\Program Files\\ColorTokens\\LGM\\ct-lgm.exe") and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\cvtres.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
 not (process.executable : "?:\\Windows\\System32\\quser.exe" and process.parent.executable : "?:\\Windows\\LTSvc\\LTSVC.exe") and
 not (process.executable : "?:\\Windows\\SysWOW64\\sc.exe" and process.parent.executable : "?:\\Program Files (x86)\\NinjaRMMAgent\\NinjaRMMAgent.exe") and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\csc.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
 not (process.executable : "?:\\Windows\\System32\\cscript.exe" and process.parent.executable : "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe") and
 /* chromium and last one for Acrobat */
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05",
                          "c3cd2ec30f1f8400000000004c8bd1b829000000f604250800000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05", 
                          "c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 
                          "c30f1f4400004c8bd1b8280000000f05c30f1f44000000000000000000000000000000000000000000000000000000000000000000004c8bd1b8290000000f05", 
                          "c30f1f4400004c8bd1b8280000000f05c30f1f4400004c8bd1b8290000000f05c30f00000000000000000000000000000000000000004c8bd1b8290000000f05", 
                          "c30f1f440000ff25000000007004fd89ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                          "c3ff25000000005b14*7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 
                          "ff2554000000cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc4ecc4c8bd1b8*", 
                          "c30f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 
                          "c341514150525166660f1f840000000000909090e81c0000005c004400650076006900630065005c00470047005300530052000000681a001c00488bc46a006a",
                          "e99b3808200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes like
                                 ("ff2554000000cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc4ecc4c8bd1b8*",
                                  "ff2500000000da12d2bdf97f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                                  "c30f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                                  "e9cb2e08200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"